> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neobank.proofof.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Perflo Neobank

> Deploy a customer-facing neobank over Perflo with asynchronous operations, browser-approved payments, and strict data minimization.

# Build a neobank over Perflo

Perflo Neobank combines a FastAPI service, a transactional worker, and a React application. Perflo holds and moves the money; the wrapper owns customer identity, confirmation, idempotency, approval tracking, local mandate policy, and operator visibility.

## Choose fake or live

Use `fake` for deterministic development and tests. Use `live` for customer-bound Perflo device sessions against the five reviewed Perflo origins.

Production requires `live`, PostgreSQL, Redis, Vault over Transport Layer Security (TLS), Auth0, authenticated metrics, HTTPS application origins, and disabled debug authentication. Perflo capability requests document residual upstream improvements; they do not gate runtime startup.

<CardGroup cols={2}>
  <Card title="Run the quickstart" icon="rocket" href="/get-started/quickstart">
    Start the fake stack and inspect the customer application.
  </Card>

  <Card title="Review production readiness" icon="shield" href="/get-started/production-readiness">
    Check the live canary and operational launch evidence.
  </Card>

  <Card title="Understand the architecture" icon="diagram-project" href="/architecture/overview">
    Follow identity, operations, approvals, and reconciliation.
  </Card>

  <Card title="Deploy one server" icon="server" href="/deploy/dedicated-server">
    Run Caddy, Auth0, PostgreSQL, Redis, and TLS-enabled Vault.
  </Card>
</CardGroup>

## Follow operation state

All provider mutations return `202 Accepted` with an operation. Browser-approved transfers and mandates expose a trusted Perflo action URL. If a provider write becomes transport-uncertain, the operation enters `indeterminate`; the worker never resubmits it and uses provider reads for reconciliation.

## Keep provider data private

The public API never returns provider credentials, beneficiary destinations, token addresses, chains, card credentials, or unmasked bank identifiers. Sensitive provider context remains in Vault ciphertext, and operator operation views omit customer approval URLs.